KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has…
Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
Błędna kontrola dostępu w NASA cFS umożliwia atakującym wykonanie dowolnego kodu.
Zachowanie domyślnych danych logowania w SAP Commerce Cloud umożliwia nieautoryzowany dostęp do API.
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated…
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to…
Podatność w rozszerzeniu Helix Ultimate umożliwia nieautoryzowane usunięcie plików.
Luka w Oracle WebCenter Content umożliwia przejęcie kontroli przez atakującego zdalnie.
Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries inside the totp_pending record…
Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token…
Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie…
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.
Niekonsekwentne egzekwowanie wygasania kodów autoryzacyjnych OAuth2 w Gitea umożliwia nieautoryzowany dostęp.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component,… | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note… | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. | Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions. | Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. | Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions. | Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. |
W tym tygodniu | 9,1 | 0,5 % | ||
| In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. | In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has… |
W tym tygodniu | 9,1 | 0,5 % | ||
| Same-origin policy bypass in the DOM: Service Workers component. | Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Błędna kontrola dostępu w NASA cFS umożliwia atakującym wykonanie dowolnego kodu. | Błędna kontrola dostępu w NASA cFS umożliwia atakującym wykonanie dowolnego kodu. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Zachowanie domyślnych danych logowania w SAP Commerce Cloud umożliwia nieautoryzowany dostęp do API. | Zachowanie domyślnych danych logowania w SAP Commerce Cloud umożliwia nieautoryzowany dostęp do API. |
W tym tygodniu | 9,1 | 0,5 % | ||
| ThingLinks is an enterprise IoT platform. | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated… |
W tym tygodniu | 9,1 | 0,5 % | ||
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')… | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to… |
W tym tygodniu | 9,1 | 0,5 % | ||
| Podatność w rozszerzeniu Helix Ultimate umożliwia nieautoryzowane usunięcie plików. | Podatność w rozszerzeniu Helix Ultimate umożliwia nieautoryzowane usunięcie plików. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Luka w Oracle WebCenter Content umożliwia przejęcie kontroli przez atakującego zdalnie. | Luka w Oracle WebCenter Content umożliwia przejęcie kontroli przez atakującego zdalnie. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie… | Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challenge_path keeps the failure count as tries inside the totp_pending record… |
W tym tygodniu | 9,1 | 0,5 % | ||
| Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no… | Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client and documents both as client registration. token… |
W tym tygodniu | 9,1 | 0,5 % | ||
| Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. | Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret. The session keyword freezes its options onto the application as given: it does not require a secret, warn, or refuse to start when one is absent. The cookie… |
W tym tygodniu | 9,1 | 0,5 % | ||
| SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,5 % | ||
| SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to… | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,5 % | ||
| SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a… | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,5 % | ||
| SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator… | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,5 % | ||
| SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator… | SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,5 % | ||
| SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to… | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments. |
W tym tygodniu | 9,1 | 0,5 % | ||
| Niekonsekwentne egzekwowanie wygasania kodów autoryzacyjnych OAuth2 w Gitea umożliwia nieautoryzowany dostęp. | Niekonsekwentne egzekwowanie wygasania kodów autoryzacyjnych OAuth2 w Gitea umożliwia nieautoryzowany dostęp. |
W tym tygodniu | 9,1 | 0,5 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.